安全政策

Reporting a Vulnerability

If you believe you have found a security vulnerability in mt5depot, email security@mt5depot.com. This is the same address published in our machine-readable security.txt (RFC 9116). Reports are read in English.

Please report privately and give us a chance to fix the issue before disclosing it publicly. We do not require you to sign anything before reporting.

What to Include

1. The URL, endpoint, or page where the issue occurs.
2. What the issue is, and what an attacker could do with it.
3. The steps needed to reproduce it, in order.
4. Any request/response pairs, screenshots, or a short proof-of-concept.
5. Whether you have shared the finding with anyone else.

A clear reproduction is the single thing that most affects how quickly we can act.

Scope

In scope: mt5depot.com and the services it runs on — the site itself, the account and download flows, the mt5depot Builder, and our api, compile, and bt subdomains.

Out of scope:

• Third-party broker websites, trading platforms, and their account systems. We are an introducing broker, not the operator of those services — report issues there to the broker.
• MetaTrader 5 itself, which is software published by MetaQuotes Software Corp.
• The behaviour or code quality of Expert Advisors — including files contributed to the free EA pool. If a submitted file looks malicious, tell us and we will remove it; that is handled under our Terms of Service, not as a site vulnerability.
• Findings that are only the output of an automated scanner, with no demonstrated impact.
• Missing hardening headers, TLS configuration preferences, or rate limits, where no concrete attack is shown.
• Social engineering of our staff or users, and physical attacks.

Testing Rules

While investigating, please:

• Use only accounts you own or test accounts you created.
• Stop as soon as you have confirmed a vulnerability — do not read, modify, download, or retain other people's data.
• Do not run denial-of-service, load, or brute-force tests against our systems.
• Do not use automated scanners that generate high request volumes.
• Do not modify or destroy data, and do not degrade the service for other users.

What You Can Expect

• We aim to acknowledge your report within 5 business days.
• We will tell you whether we consider the issue in scope, and what we intend to do about it.
• We will let you know when the issue is fixed.
• If you would like to be credited once the fix is live, say so in your report and we will name you. You may also stay anonymous.

No Bug Bounty

We do not operate a paid bug bounty programme and do not offer monetary rewards. Reports are handled on a goodwill basis. We would rather say this plainly than imply a payment that does not exist.

Safe Harbour

If you make a good-faith effort to follow this policy, we will not pursue legal action against you for your research, and we will treat your activity as authorised. If a third party brings action against you for research conducted within this policy, we will make it known that your activity was authorised.

This does not extend to activity outside the scope above, or to accessing, retaining, or disclosing other users' data.

Machine-Readable Policy

Our contact details are also published at /.well-known/security.txt, which points back to this page. If the two ever disagree, this page is the one we maintain.

Contact

Security reports: security@mt5depot.com. For anything that is not a security issue, use our contact form.